No Actions taken by IPS with High Severity event

[edisonguerrero]

Hi Comunity,

I wanted to ask about an alert fired on the IPS. The signature has a high severity, but no actions were taken by the IPS. I checked the Event Action Filters and there is not any filter to avoid apply actions to this traffic.

The alarm was:

Thanks.

[nspasov]

Is your IPS policy set to block or monitor only? 

Thank you for rating helpful posts!

[edisonguerrero]

Hi,

By default, the signature has a High severity and the default action is "Produce Alert". Otherway, with a Hihgh Risk Rating, the Event Action Overrides has the acction "Deny Packet Inline" to add.